90 Degree Benefits, Inc. – MN/WI Office Data Breach — Class Action Review

Operating within the complex ecosystem of employee health and welfare benefits administration, 90 Degree Benefits, Inc. – MN/WI Office functions as a critical third-party administrator (TPA) connecting employers, plan members, and healthcare providers. Because of its core operational focus, this organization routinely collects, processes, and stores an extensive volume of highly sensitive personal and protected health information. Employers rely on entities like 90 Degree Benefits to manage self-funded health plans, process medical and dental claims, and coordinate benefit eligibility. Consequently, the company maintains robust digital repositories containing comprehensive dossiers on thousands of participants, making it an attractive target for cybercriminals seeking high-value records that command a premium on the dark web.

In 2025, the organization reported a significant cybersecurity incident to the California Attorney General, highlighting the pervasive vulnerabilities facing administrative intermediaries in the healthcare and insurance sectors. While specific technical forensics continue to be evaluated, incidents of this nature typically involve sophisticated cyberattacks such as unauthorized intrusion into internal databases, ransomware deployment, or a compromise within the third-party vendor supply chain. Organizations that aggregate vast amounts of administrative, financial, and medical data often become targets for threat actors who exploit undetected security gaps, misconfigured cloud storage, or compromised employee credentials to bypass perimeter defenses and exfiltrate confidential files.

The exposure resulting from the 90 Degree Benefits breach compromises a dangerous amalgam of personally identifiable information (PII) and protected health information (PHI), creating severe, multi-faceted risks for affected individuals. Exposed categories frequently include full names, dates of birth, Social Security numbers, health insurance policy numbers, claims adjudication data, and sensitive medical diagnosis or treatment details. When malicious actors obtain this combination of data, victims face an immediate and prolonged threat of identity theft, medical fraud—where unauthorized individuals utilize compromised health insurance IDs to obtain medical services or prescription drugs—financial account takeover, and targeted phishing schemes. Unlike a single compromised credit card that can be easily cancelled, immutable data such as Social Security numbers and medical histories expose victims to lifelong risks of synthetic fraud and administrative nightmares.

As a custodian of sensitive health and personal records, 90 Degree Benefits, Inc. – MN/WI Office was bound by stringent legal and regulatory frameworks, including the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and state consumer protection statutes. These laws impose strict affirmative duties on administrators to implement robust administrative, physical, and technical safeguards—such as multi-factor authentication, end-to-end encryption, regular vulnerability assessments, and strict access controls—to protect consumer data from unauthorized access. The occurrence of a data breach of this magnitude serves as a strong indicator that the company may have failed to maintain adequate security protocols, potentially breaching its statutory and common-law duties of care to safeguard the confidential information entrusted to its care.

Receiving a formal data breach notification letter from 90 Degree Benefits, Inc. – MN/WI Office is a formal acknowledgment by the company that your confidential records were compromised as a result of its security failures. Under California law, the receipt of such a notice establishes legal standing to initiate or participate in a class action lawsuit seeking accountability, enhanced credit monitoring, and financial compensation. Importantly, affected individuals are not required to demonstrate actual out-of-pocket financial loss or identity theft to pursue legal recourse; the increased risk of future harm and the unlawful exposure of private data are sufficient grounds for action. Our firm evaluates these cases on a contingency fee basis, meaning you pay nothing out of pocket and we only recover fees if we successfully secure a recovery on your behalf.